Board Reporting
Board attention items
The small number of things put in front of directors, derived from severity, evidence gaps and cost, rather than chosen editorially.
What it is
A short list of items the pack raises for board attention.
How they are derived
From the assessment itself: critical control failures, domains that could not be assessed, and evidenced cost recovery of material size. Not selected by hand.
Why derived rather than curated
A curated list is an opinion that varies with who wrote it. A derived list is reproducible, and its rules can be stated.
Why evidence gaps appear here
Because a domain that could not be assessed is a governance issue in its own right. A board should hear that part of the environment could not be evidenced, not only what was found in the part that could.
What it does not mean
It is not a prioritised remediation plan. It is what a board should ask about, which is a different list from what an engineering team should do first.